Privacy notice

Information the service uses

Account information includes your email, profile name and optional country, city, timezone, language, company and job title. Your saved articles, events, followed sectors, notification choices and membership records support the features you use.

Sign-in is managed through Supabase Auth. Password and authenticator verification are handled by the authentication service; an email message is not an authenticator code. API keys have limited scopes, and only their digest and identifying prefix are stored by the application.

Why information is used

The application uses account information to provide sign-in, personalise your saved preferences, control access to member content, and show membership and notification records. Recovery requests include the email and explanation you provide so access issues can be reviewed.

Optional product offers and optional readership analytics are separate from the account features. Turning either choice off must not block reading or membership. The final purpose-specific legal grounds remain an owner review item.

Optional readership analytics

The analytics design records selected reading and feature actions only after an explicit choice. It excludes search text, query strings, private forms, authentication, account and administration pages. Browser Do Not Track and Global Privacy Control signals stop collection.

A random browser identifier changes each UTC day and is held in memory. The server creates a daily pseudonym with a salt that changes on restart. Signed-in activity may also be linked to an account ID; pseudonymous does not mean anonymous. Existing analytics is reportable for the last 90 UTC days, with expired events removed in bounded request-driven batches. A scheduled cleanup service is not configured.

Services, storage and transfers

The local build uses project-specific Supabase services. Google sign-in, transactional email, payment processors, external AI and social delivery each require their own setup and approval. Available adapter code does not mean an external service is active.

Mailpit captures development messages locally. ZeptoMail is the intended transactional email adapter when enabled. Stripe and Razorpay adapters support payments when configured. Hosting regions, processor agreements and international-transfer safeguards must be confirmed before live use.

Your choices and privacy requests

You can review your profile and separate communication and analytics choices from your account page. Security settings manage sign-in and enrolled authenticator factors. Canceling a membership does not delete your account.

Access, correction, deletion, portability, restriction or objection rights may apply under the law governing your situation. The contact form can record a local privacy request, but a received request is not a completed export or erasure. Dedicated identity checks, fulfilment and a verified privacy contact must be ready before launch. This preview does not promise a response deadline.

Retention and security

Account, billing, audit, recovery, support and backup records need distinct approved retention schedules. The analytics limit does not establish a retention period for every other record. Deletion can require lawful exceptions, provider follow-up and backup expiry.

The application uses access checks, authenticated administration and safe public error messages. These measures do not establish an independent security certification. Incident response, breach notification, restored-backup deletion and a full data inventory remain release review items.

Younger readers and changes

Public learning material remains open without an account. The owner-approved direction is to start with accounts for people aged 18 or older, using a self-declared 18+ or under-18 choice. A declaration is not independent age verification. Under-18 accounts with verified guardian safeguards are a later phase and are not available now.

The account and optional-consent controls require verification against the applied database and real signup journeys before launch. Unknown-age and under-18 records must not receive optional tracking or marketing. Saving this policy register does not activate an age gate or establish guardian consent.

This working notice has no effective legal date. Material changes need an approved notice process and refreshed choices when required. We do not claim worldwide privacy compliance.